diff --git a/agents/services/pod_overlay.go b/agents/services/pod_overlay.go
index 36143e327..d990f0ab7 100644
--- a/agents/services/pod_overlay.go
+++ b/agents/services/pod_overlay.go
@@ -76,12 +76,12 @@ type WorkloadServiceAccount struct {
 	Annotations map[string]string
 }
 
-// AttachWorkloadIdentity binds a cell's declared runtime identity to the
+// AttachWorkloadIdentity binds an environment's declared runtime identity to the
 // workload: the identity's annotations land on the codefly-owned ServiceAccount
 // and its labels on the pod template, both verbatim. Doing it from the declared
 // contract is what keeps the identity out of every agent's template and out of
-// per-cell branches here — codefly stamps keys it does not interpret, so a cell
-// on any platform wires its own identity webhook by declaring it.
+// per-environment branches here — codefly stamps keys it does not interpret, so an
+// environment on any platform wires its own identity webhook by declaring it.
 //
 // Conflicting declarations are errors, not permission to choose an identity.
 func (o *PodTemplateOverlay) AttachWorkloadIdentity(identity *resources.EnvironmentWorkloadIdentity) error {
@@ -128,7 +128,7 @@ func (o *PodTemplateOverlay) AttachWorkloadIdentity(identity *resources.Environm
 	return nil
 }
 
-// ProjectWorkloadIdentity attaches a cell's declared runtime identity to an
+// ProjectWorkloadIdentity attaches an environment's declared runtime identity to an
 // already-rendered manifest tree: it writes the codefly-owned ServiceAccount
 // into baseDir, wires it into that same directory's kustomization, and stamps
 // serviceAccountName and the identity's labels onto every pod-template workload
diff --git a/agents/services/pod_overlay_test.go b/agents/services/pod_overlay_test.go
index 87a9a593a..a56ad7843 100644
--- a/agents/services/pod_overlay_test.go
+++ b/agents/services/pod_overlay_test.go
@@ -624,10 +624,10 @@ func TestAddKustomizeResourceIsIdempotent(t *testing.T) {
 }
 
 // TestProjectWorkloadIdentityRendersDeclaredAttachment walks the whole seam a
-// deployment does: a cell's declared identity is projected onto an
+// deployment does: an environment's declared identity is projected onto an
 // already-rendered tree, which gains a ServiceAccount carrying the platform's
 // annotations and a workload bound to it with the platform's labels. Nothing in
-// the path interprets the keys, so a cell on any platform wires its own identity
+// the path interprets the keys, so an environment on any platform wires its own identity
 // webhook by declaring it.
 func TestProjectWorkloadIdentityRendersDeclaredAttachment(t *testing.T) {
 	dir := renderedWorkloadTree(t)
@@ -787,8 +787,8 @@ func TestAttachWorkloadIdentityRejectsConflictingCallerValues(t *testing.T) {
 	}
 	err := overlay.AttachWorkloadIdentity(&resources.EnvironmentWorkloadIdentity{
 		Principal:   "p",
-		Annotations: map[string]string{"shared": "cell", "added": "cell"},
-		Labels:      map[string]string{"shared": "cell", "added": "cell"},
+		Annotations: map[string]string{"shared": "platform", "added": "platform"},
+		Labels:      map[string]string{"shared": "platform", "added": "platform"},
 	})
 	require.ErrorContains(t, err, "conflicts")
 	require.Equal(t, "chosen", overlay.ServiceAccount.Name)
diff --git a/network/remote_manager.go b/network/remote_manager.go
index 4f12734ba..b791d1db7 100644
--- a/network/remote_manager.go
+++ b/network/remote_manager.go
@@ -109,7 +109,7 @@ func (m *RemoteManager) GenerateNetworkMappings(ctx context.Context,
 		// External endpoints (e.g. public load-balanced) resolve to an
 		// environment-specific public host. A declared dns.codefly.yaml entry
 		// wins when present; otherwise the host is derived from the
-		// environment's declared app host suffix (sourced from the cell
+		// environment's declared app host suffix (sourced from the coordinate
 		// contract) so a promotable render is value-free — no local value file
 		// required. Only when neither exists is there nothing to route to.
 		if resources.IsExternalEndpoint(endpoint) {
diff --git a/resources/coordinate_contract_test.go b/resources/coordinate_contract_test.go
index 7124ab6c7..b1e7d9344 100644
--- a/resources/coordinate_contract_test.go
+++ b/resources/coordinate_contract_test.go
@@ -176,7 +176,7 @@ func TestCoordinateContractRejectsInvalidDeclarations(t *testing.T) {
 		replacement string
 		want        string
 	}{
-		{"retired schema", `"codefly/coordinate/v1"`, `"codefly/cell/v1"`, "unsupported coordinate-contract schema"},
+		{"unsupported version", `"codefly/coordinate/v1"`, `"codefly/coordinate/v2"`, "unsupported coordinate-contract schema"},
 		{"capability", `"managed-service-identity"`, `"unknown-capability"`, "unsupported capability"},
 		{"principal", `"principal": "accounts-client"`, `"principal": " "`, "principal"},
 		{"endpoint", `"external-name": "accounts.example"`, `"external-name": ""`, "endpoint"},
@@ -246,7 +246,7 @@ func TestCoordinateContractValidatesExplicitSecretReferences(t *testing.T) {
 	}
 }
 
-func TestCellEnvironmentOwnsItsConfiguration(t *testing.T) {
+func TestCoordinateEnvironmentOwnsItsConfiguration(t *testing.T) {
 	for _, fixture := range []string{"password-auth.json", "managed-identity.json"} {
 		contract, err := ParseCoordinateContract(loadCoordinateFixture(t, fixture))
 		if err != nil {
@@ -301,17 +301,3 @@ func TestCoordinateContractRefusesRetargetingAndDirectInvalidValues(t *testing.T
 		t.Fatal("directly constructed invalid value bypassed admission")
 	}
 }
-
-// The rename left one spelling. Both retired ones are refused, so a document
-// naming itself the old way fails loudly instead of being silently guessed at.
-func TestCoordinateContractRefusesEveryRetiredSpelling(t *testing.T) {
-	for _, retired := range []string{"codefly/cell/v1", "codefly/cell/v2"} {
-		t.Run(retired, func(t *testing.T) {
-			data := strings.Replace(string(loadCoordinateFixture(t, "managed-identity.json")), `"codefly/coordinate/v1"`, `"`+retired+`"`, 1)
-			_, err := ParseCoordinateContract([]byte(data))
-			if err == nil || !strings.Contains(err.Error(), "unsupported coordinate-contract schema") {
-				t.Fatalf("%s was not refused: %v", retired, err)
-			}
-		})
-	}
-}
diff --git a/resources/environment.go b/resources/environment.go
index 780a7c77e..88961aafc 100644
--- a/resources/environment.go
+++ b/resources/environment.go
@@ -157,7 +157,7 @@ type EnvironmentManagedService struct {
 
 // EnvironmentWorkloadIdentity is the runtime principal a workload authenticates
 // as, and the platform's own means of attaching it. Annotations land on the
-// workload's ServiceAccount and Labels on its pod template, verbatim: a cell
+// workload's ServiceAccount and Labels on its pod template, verbatim: an environment
 // declares whatever its identity webhook keys off and codefly stamps it without
 // interpreting the keys.
 type EnvironmentWorkloadIdentity struct {
@@ -465,7 +465,7 @@ type Environment struct {
 
 	// ResourceQuota, when set, renders a ResourceQuota (and an optional
 	// LimitRange of container defaults) into this environment's namespace so one
-	// workspace sharing a cell cannot starve another. Absent, no quota is
+	// workspace sharing an environment cannot starve another. Absent, no quota is
 	// rendered and the namespace stays uncapped. CLI-side; not serialized to
 	// proto.
 	ResourceQuota *EnvironmentResourceQuota `yaml:"resource-quota,omitempty"`
@@ -479,7 +479,7 @@ type Environment struct {
 // EnvironmentDNS is the environment's DNS contract.
 type EnvironmentDNS struct {
 	// AppHostSuffix is the public host suffix an app's external endpoints hang
-	// off of in this cell (e.g. "staging.eastus2.azure.example.com"). Empty means
+	// off of in this environment (e.g. "staging.eastus2.azure.example.com"). Empty means
 	// no declared suffix, so external hosts fall back to a local dns.codefly.yaml.
 	AppHostSuffix string `yaml:"app-host-suffix,omitempty"`
 }
@@ -488,7 +488,7 @@ type EnvironmentDNS struct {
 // reachable at in this environment, or "" when no app host suffix is declared.
 // The label is "<service>-<module>" (the service-module subdomain convention,
 // see shared.ToDNSCase) so services sharing a name across modules do not collide
-// under one cell suffix; the suffix already scopes the cell/environment.
+// under one host suffix; the suffix already scopes the environment.
 func (env *Environment) AppHost(service *ServiceIdentity) string {
 	if env == nil || env.Dns == nil || env.Dns.AppHostSuffix == "" || service == nil {
 		return ""
diff --git a/resources/environment_test.go b/resources/environment_test.go
index a27ce43f0..3bb0a9720 100644
--- a/resources/environment_test.go
+++ b/resources/environment_test.go
@@ -576,7 +576,7 @@ environments:
 	}
 }
 
-// Workspace load refuses the same collision the cell contract does, and accepts
+// Workspace load refuses the same collision the coordinate contract does, and accepts
 // the same key under two different services, which is not a collision at all.
 func TestEnvironmentRefusesKeyDeclaredAsBothValueAndSecret(t *testing.T) {
 	workspaceWith := func(configService string) string {
diff --git a/resources/testdata/coordinates/no-auth-declaration.json b/resources/testdata/coordinates/no-auth-declaration.json
index ba8819399..a983c8e6e 100644
--- a/resources/testdata/coordinates/no-auth-declaration.json
+++ b/resources/testdata/coordinates/no-auth-declaration.json
@@ -1,6 +1,5 @@
 {
-  "schema": "codefly/cell/v1",
-  "cell": "hosted-eastus2",
+  "schema": "codefly/coordinate/v1",
   "coordinate": "hosted/azure/eastus2/US/staging",
   "cluster": { "kind": "aks", "context": "obinh-eus2-aks", "private_api": true },
   "dns": { "app_host_suffix": "staging.eastus2.azure.obin.obin.ai" },